Harden IDE lookup and WebFetch private-IP handling#14878
Harden IDE lookup and WebFetch private-IP handling#14878dev-shinyu wants to merge 4 commits intogoogle-gemini:mainfrom
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Summary of ChangesHello @dev-shinyu, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security posture of the application by implementing safer command execution for IDE integrations and introducing a more robust private IP detection system for web fetching. These changes aim to mitigate risks associated with arbitrary command execution and prevent unintended access to internal network resources, ensuring a more secure and reliable operation. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces significant security hardening for IDE command lookups and private IP detection in WebFetch. The move from execSync to spawnSync effectively mitigates command injection risks. The reworked private IP detection is much more robust, now including DNS resolution. However, I've found a critical issue in the new IPv4 address parsing logic that could lead to incorrect identification of private IPs, undermining the security improvements. My review includes a specific comment with a suggested fix for this issue.
| return parts.reduce((acc, part) => { | ||
| const num = Number(part); | ||
| if (Number.isNaN(num)) { | ||
| return NaN; | ||
| } | ||
| return (acc << 8) + num; | ||
| }, 0); |
There was a problem hiding this comment.
The use of the bitwise left-shift operator (<<) for converting an IP address to a number is incorrect and can lead to bugs. In JavaScript, bitwise operations are performed on signed 32-bit integers. This causes incorrect calculations for IP addresses where the numeric value would exceed 2^31 - 1 (e.g., any IP address starting with 128 or greater). As a result, private IP ranges like 192.168.0.0/16, 172.16.0.0/12, and 169.254.0.0/16 will not be correctly identified, which could expose internal services. Using multiplication instead of bitwise shifting will correctly handle the full range of unsigned 32-bit integer values for IPv4 addresses.
return parts.reduce((acc, part) => {
const num = Number(part);
if (Number.isNaN(num)) {
return NaN;
}
// Use multiplication to avoid signed 32-bit integer overflow with bitwise shifts.
return acc * 256 + num;
}, 0);
gemini-cli
bot
added
the
status/need-issue
|
Hi @dev-shinyu, thank you so much for your contribution to Gemini CLI! We really appreciate the time and effort you've put into this. We're making some updates to our contribution process to improve how we track and review changes. Please take a moment to review our recent discussion post: Improving Our Contribution Process & Introducing New Guidelines. Key Update: Starting January 26, 2026, the Gemini CLI project will require all pull requests to be associated with an existing issue. Any pull requests not linked to an issue by that date will be automatically closed. Thank you for your understanding and for being a part of our community! |
|
Hi there! Thank you for your contribution to Gemini CLI. To improve our contribution process and better track changes, we now require all pull requests to be associated with an existing issue, as announced in our recent discussion and as detailed in our CONTRIBUTING.md. This pull request is being closed because it is not currently linked to an issue. You can easily reopen this PR once you have linked it to an issue. How to link an issue: Thank you for your understanding and for being a part of our community! |
2 participants
Summary
Harden IDE CLI lookup and WebFetch private-IP checks to improve safety.
Changes
Tests